Using AWS CloudFront to enhance the performance, Security & Availability of your application

#aws #cloud #security #cloudcomputing

Hosting a website that serves a lot of customers around the world then AWS CloudFront should be considered by you since it distributes your content of your website and store them at the nearest edge location to your clients.

This significantly improves performance and reduces loading times which enhances the customer's experience

In this article I will try to explain CloudFront features that can be used to enhance the overall experience of your website

We are going to discuss the below features

Origin Group and Multiple Origins
CloudFront Functions
Global Accelerator
CloudFront Security

But before we start, we will try to explain how does CloudFront work

Overview

They key architectural components of CloudFront are distribution, Edge locations or Point of Presence, Regional Edge Cache, Origin & Caching Behavior

Let's walkthrough them one by one

Distribution: this the primary resource you create, and it contains the configurations including origins, caching behavior and security settings.
Edge Locations: there can be considered as data centers where content is cached
Regional Edge Cache: this is larger caching layer located between edge locations & origin, they store less popular content for larger periods than smaller edge locations
Origin: This is the source of your content, It can be S3, ALB, NLB EC2 or On-permise server, you can find more information Origin Types
Cache Behavior: set of configuration rules you apply to specific URL patterns, for example routing, TTL or redirection

Referring to AWS official documents this is how architecture looks like

CloudFront has a lot of features that could help you to go beyond if you used them correctly, Let's discuss them one by one

Feature

Origin Group & Multiple Origin

As mentioned earlier, Origin is the source of your data, the OriginGroup feature allow you to add multiple origins to the same group (primary origin & secondary origin) in addition to a failover criteria you define, This means if you send a request to your primary region and origin responded with an error status code, request will be redirected to the secondary origin.

you can use muliple origin groups to server the contents based on their types,

for example: You can redirect the static content to Origin A while dynamic content to Origin B

Global Accelerator

It achieves low latency and high performance by utilizing AWS global network and avoid going to the public internet,

it works by providing a static IP address to your application and route the traffic through the optimal route & healthy endpoint

Use Cases

Routing to Multiple Origin

CloudFront Cache Behavior can be used to route traffic based on the path pattern as below:

This allows you to serve static & dynamic origin instead of having different architecture for both content type

Origin Failover Through Origin Groups

This feature helps you to achieve high availability by forwarding failed requests to another Origin.

Restrict Access Through Custom Headers

By adding Custom Header on CloudFront and modifying the requests, this will allow us to define a rule on the ALB that if the requests don't contain the Custom Header will be denied, any direct access will be blocked by the defined rules on the ALB

Closing Words

CloudFront is a powerful service if you are looking to distribute your application or website globally, it has many features that will help you to achieve high availability, security and reduce latency for the clients that reaching your application.